On single-photon quantum key distribution in the presence of loss 
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We investigate two-way and one-way single-photon quantum key distribution (QKD) protocols 
in the presence of loss introduced by the quantum channel. Our analysis is based on a simple 
precondition for secure QKD in each case. In particular, the legitimate users need to prove that 
there exists no separable state (in the case of two-way QKD), or that there exists no quantum state 
having a symmetric extension (one-way QKD), that is compatible with the available measurements 
results. We show that both criteria can be formulated as a convex optimisation problem known as 
a semidefinite program, which can be efficiently solved. Moreover, we prove that the solution to 
the dual optimisation corresponds to the evaluation of an optimal witness operator that belongs to 
the minimal verification set of them for the given two-way (or one-way) QKD protocol. A positive 
expectation value of this optimal witness operator states that no secret key can be distilled from the 
available measurements results. We apply such analysis to several well-known single-photon QKD 
protocols under losses. 

PACS numbers: 



I. INTRODUCTION 

Quantum key distribution (QKD) protocols typically 
involve a two-step procedure in order to generate a secret 
key First, the legitimate users (Alice and Bob) per- 

form a set of measurements on effective bipartite quan- 
tum states that are distributed to them. As a result, 
they end up with a classical joint probability distribu- 
tion, that we shall denote as p{ai,bj) = pij, describing 
their outcomes. The second step consists of a classical 
post-processing of the data pij. It requires an authen- 
ticated classical channel, and it includes post-selection 
of data, error-correction to reconcile the data, and pri- 
vacy amplification to decouple the data from a possible 
eavesdropper (Eve) [l|, [1| . 

In order to create the correlated data pij, QKD 
schemes usually require Alice to prepare some non- 
orthogonal quantum states Itpi) with a priori probabil- 
ities Pi that are sent to Bob. On the receiving side. 
Bob measures each received signal with a positive op- 
erator value measure (POVM) {Bj}. Generalising the 
ideas introduced by Bennett et al. in Ref. the sig- 
nal preparation process in this kind of schemes can al- 
ternatively be thought of as follows: Alice produces first 



bipartite states \ 



source) AB = Hi VPi\Oi-i) A\'^i) B ^^d' af- 
terwards, she measures the first subsystem in the orthog- 
onal basis \oii) corresponding to the measurement op- 
erators Ai = |ai)^(ai|. This action generates the signal 
states IV'i) with a priori probabilities pi. The reduced 
density matrix of Alice, pA = Tr_B(|V'source)AB('0so«rce|), 
depends only on the probabilities pi and on the overlap of 
the signals states \^i). This means, in particular, that pA 



is always fixed by the preparation process and cannot be 
modified by Eve. In order to include this information in 
the measurement process one can add to the observables 
{Ai®Bj}, measured by Alice and Bob, other observables 
{Ck <E) such that the observables {Ck} form a tomo- 
graphic complete set of Alice's Hilbert space 4]. From 
now on, we will consider that the datap^j and the POVM 
{Ai (g) Bj} include also the observables {Cfc (8) 1}. 

The classical post-processing of pij can involve either 
two-way or one-way classical communication. Two-way 
classical communication protocols can tolerate a higher 
error rate than one-way communication techniques [H]- 
On the other hand, one-way post-processing methods 
typically allow to derive simpler unconditional security 
proofs for QKD than those based on two-way communica- 
tion 0, B ■ In this last paradigm, two different cases 
can be considered: Reverse reconciliation (RR) refers to 
communication from Bob to Alice, and Direct reconcil- 
iation (DR) permits only communication from Alice to 
Bob. (See, for instance, Refs. [lol.[l]|.) 

An essential question in QKD is to determine whether 
the correlated data pij allow Alice and Bob to generate 
a secret key at all during the second phase of QKD. Here 
we consider the so-called trusted device scenario, where 
Eve cannot modify the actual detection devices employed 
by Alice and Bob, as used in Refs. We assume 

that the legitimate users have complete knowledge about 
their detection devices, which are fixed by the actual ex- 
periment. The case of two-way classical post-processing 
has been analysed in Ref. [l^, where it was proven that 
a necessary precondition for secure two-way QKD is the 
provable presence of quantum correlations in pij. That 
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is, it must be possible to interprete pij , together with the 
knowledge of the corresponding observables {Ai(^Bj}, as 
coming exclusively from an entangled state. Otherwise, 
no secret key can be distilled from pij . In order to deliver 
this entanglement proof any separability criteria (see, for 
instance, Ref. and references therein) might be cm- 
ployed. The important question here is whether the cho- 
sen criterion can provide a necessary and sufficient con- 
dition to detect entanglement even when the knowledge 
about the quantum state is not tomographic complete. 
It was proven in Ref. [l^ that entanglement witnesses 
(EWs) fulfill this condition. An EW is an Hermitian 
operator W with a positive expectation value on all sep- 
arable states So, if a state pab obeys 
Ti:{pabW) < 0, the state pab must be entangled. With 
this separability criterion, Refs. [1, [l^ analysed three 
well-known qubit-based QKD schemes, and provided a 
compact description of a minimal verification set of EWs 
(i.e, one that does not contain any redundant EW) for 
the four-state [11] and the six-state [HI QKD protocols, 
and a reduced verification set of EWs {i.e., one which 
may still include some redundant EWs) for the two-state 
[20] QKD scheme, respectively. These verification sets of 
EWs allow a systematic search for quantum correlations 
in Pij . One negative expectation value of one EW in the 
set suffices to detect entanglement. To guarantee that 
no verifiable entanglement is present in pij, however, it 
is necessary to test all the members of the set. Unfor- 
tunately, to find a minimal verification set of EWs, even 
for ideal qubit-based QKD schemes, is not always an easy 
task, and it seems to require a whole independent analysis 
for each protocol, let alone for hig her dimensional QKD 
schemes jl,[l^. (See also Ref. [2ll| ) Also, one would like 
to include in the analysis the attenuation introduced by 
the quantum channel, not considered in Refs. [1, [l3|) and 
which represents one of the main limitations for optical 
realisations of QKD. 

One central observation of this paper is very simple, 
yet potentially very useful: Given any qubit-based two- 
way QKD scheme, one can search for quantum correla- 
tions in Pij by just applying the positive partial transpo- 
sition (PPT) criterion [T^ |22| adapted to the case of a 
quantum state that cannot be completely reconstructed. 
This criterion provides a necessary and sufficient entan- 
glement verification condition for any qubit-based QKD 
protocol even in the presence of loss introduced by the 
channel, since, in this scenario, only nonpositive partial 
transposed (NPT) entangled states exist. Moreover, it is 
rather simple to evaluate in general since it can be cast 
into the form of a convex optimisation problem known 
as semidefinite program (SDP) [H, [23|. Such instances 
of convex optimisation problems can be solved efficiently, 
for example by means of interior-point methods [H, . 
This means, in particular, that this criterion can be ap- 
plied to any qubit-based QKD scheme in a completely 
systematic way. 

One-way QKD schemes can be analysed as well with 
SDP techniques. It was shown in Ref. [2^ that a neces- 



sary precondition for one-way QKD with RR (DR) is that 
Alice and Bob can prove that there exists no quantum 
state having a symmetric extension to two copies of sys- 
tem A (system B) that is compatible with the observed 
data Pij . This kind of states (with symmetric extensions) 
have been analysed in detail in Refs. [1^, [13, [111 , where it 
was proven that the search for symmetric extensions for 
a given quantum state can be stated as a SDP. (See also 
Refs. f29l [30I .) Here we complete the results contained 
in Ref. j25l| now presenting specifically the analysis for 
the case of a lossy channel. 

Both QKD verification criteria mentioned above, based 
on SDP techniques, also provide a means to search for 
witness operators for a given two-way or one-way QKD 
protocol in a similar spirit as in Refs. [i,[ll. Any SDP 
has an associated dual problem that represents also a 
SDP [H, [l^l . This dual problem can be used to obtain 
a certificate of infeasibility whenever the primal problem 
is actually infeasible. Most importantly, it can be proven 
that the solution to this dual problem corresponds to the 
evaluation of an optimal witness operator, that belongs 
to the minimal verification set of them for the given pro- 
tocol, on the observed data pij. A positive expectation 
value of this optimal witness operator indicates that no 
secret key can be distilled from the observed data pij . 

The paper is organised as follows. In Sec. II we in- 
troduce the QKD verification criteria for two-way and 
one-way QKD in more detail, and we show how to cast 
them as primal SDPs. Then, in Sec. Ill, we present 
the dual problems associated to these primal SDPs, and 
we show that the solution to these dual problems corre- 
sponds to evaluating an optimal witness operator on the 
observed data pij for the given protocol. These results 
are then illustrated in Sec. IV, where we investigate in 
detail the two-state QKD protocol [l!] in the presence of 
loss. The analysis for other qubit-based QKD schemes 
is completely analogous, and we include very briefly the 
results of our investigations on other QKD protocols in 
an Appendix. Finally, Sec. V concludes the paper with 
a summary. 

II. QKD VERIFICATION CRITERIA 

Our starting point is the observed joint probability dis- 
tribution Pij obtained by Alice and Bob after their mea- 
surements {Ai (g) Bj}. This probability distribution de- 
fines an equivalence class S of quantum states that are 
compatible with it, 

S = {pAB I Tr(A, ® Bj pab) = P^■J. Vi, j} . (1) 

By definition, every pab S S can represent the state 
shared by Alice and Bob before their measurements. 

In single-photon QKD schemes in the presence of loss, 
any state pab S S can be described on an Hilbert space 
0.2 ® Ti-f , with and Ti^ denoting, respectively, Al- 
ice's and Bob's Hilbert spaces, and where the subscript 
indicates the dimension of the corresponding Hilbert 
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space. To see this, we follow the signal preparation 
model introduced previously, where Alice prepares states 

source) AB = YliJo' y/Pi\(^i) A\'^i) B ^ , and, 

afterwards, she measures the first subsystem in the or- 
thogonal basis \oii) j^. Using Neumark's theorem [3ll[33|. 
we can alternatively describe the preparation process as 
Alice producing first bipartite states on Ti^®?^^ and, af- 
terwards, she measures the first subsystem with a POVM 
{^Jj^o^- (See also Ref. (Hi.) To include the loss of a 
photon in the quantum channel, we simply enlarge Bob's 
Hilbert space from to by adding the vacuum 
state \vac) g. 

A. Two-way QKD 

Let us now consider two-way QKD protocols. When- 
ever the observed joint probability distribution pij, to- 
gether with the knowledge of the corresponding measure- 
ments performed by Alice and Bob, can be interpreted 
as coming from a separable state Usep then no secret key 
can be distilled from the observed data • In ® Tif 
only NPT entangled states exist and, therefore, a simple 
necessary and sufficient criterion to detect entanglement 
in this scenario is given by the PPT criterion [15,,^]: A 
state pAB & is separable if and only if its partial 

transpose is a positive operator. Partial transpose 
means a transpose with respect to one of the subsystems 
[33 |. Such a result is generally not true in higher dimen- 
sions. 

Observation 1: Consider a qubit-based QKD scheme in 
the presence of loss where Alice and Bob perform local 
measurements with POVM elements Ai and Bj, respec- 
tively, to obtain the joint probability distribution of the 
outcomes pij. Then, the correlations pij can originate 
from a separable state if and only if there exists pab G S 
such as p\g > 0. 

Proof. If Pij can originate from a separable state, then 
there exists (Tsep such as asep G S. Moreover, we have 
that any separable state satisfies crfg^ > 0. To prove the 
other direction, note that if there exists pab G S such 
that > then, since Par & (Si Tif , we find that 
PAB must be separable [ll, [2^ . ■ 

To determine whether there exists pab € S such as 
Pab — can be solved by means of a primal semidefinite 
program (SDP). This is a convex optimisation problem 
of the following form: 

minimise c'^x (2) 
subject to F{x) = Fq + Y^ x.,Fi > 0, 

i 

where the vector x = {xi, ...,xt)'^ represents the objec- 
tive variable, the vector c is fixed by the particular opti- 
misation problem, and where the matrices Fq and Fi are 
Hermitian matrices. The goal is to minimise the linear 
function c'^x subjected to the linear matrix inequality 
(LMI) constraint F(x) > [H, [2i|. If the vector c = 0, 



then the optimisation problem given by Eq. ([2]) reduces 
to find whether the LMI constraint can be satisfied for 
some value of the vector x or not. In this case, the SDP 
is called a feasibility problem. Remarkably, SDPs can be 
solved with arbitrary accuracy in polynomial time, for 
example by means of interior-point methods [1^ [l^] ■ 

According to Observation 1, we can find whether there 
exists a separable state that belongs to the equivalence 
class S just by solving the following feasibility problem 

minimise (3) 
subject to pab{^) G S, 
Pab{^) > 0, 
Pab(x) > 0, 

where the objective variable x is used to parametrise the 
density operators pab- The method used to parametrise 
PAB is discussed in detail in Sec. Ill CI 



B. One-way QKD 

One-way RR (DR) QKD schemes require from Alice 
and Bob to show that there exists no quantum state 
Pab G S with a symmetric extension to two copies of 
system A (system B) (2^. A state pab is said to have 
a symmetric extension to two copies of system A if and 
only if there exists a tripartite state paba' ^ 0, with 
Tr(pABA') = 1, and where Ti"^ ~ Ti^ , such that [2a |: 

T^T^A'ipABA') = pab, (4) 

PpABA'P = PABA', (5) 

where the swap operator P satisfies P\'ijk)ABA' ~ 
\kji) ABA' ■ This definition can be easily extended to cover 
also the case of symmetric extensions of pab to two copies 
of system B, and also of extensions of pab to more than 
two copies of system A or of system B [2^. 

To find whether pab G S has a symmetric extension to 
two copies of system A can be solved with the following 
feasibility problem: 

minimise (6) 
subject to pab{'>^) & S, 

PpABA'{y^)P = /OABA'(x), 

TrA' [PABA' (x)] = Pab(x), 

PABA'i'X.) > 0. 

Note that this SDP does not include the constraint 
Pa_b(x) > because non-negativity of the extension 
PABA'i^), together with the condition TrA'[pABA'{^)] = 
Pab{^), already implies non- negativity of pab{^)- The 
SDP for one-way QKD with DR can be obtained in a 
similar way. 
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C. Parametrisation of the SDPs 

To actually implement the SDPs given by Eq. ([3]) and 
Eq. ([S]), one can parametrise pab and Paba' such that 
some constraints are automatically fulfilled. 

In particular, one can choose an operator basis of Her- 
mitian matrices {cq? • ■ • i '''d^-i} for each Hilbert space 
T-Ld- These matrices ai can be taken such as they sat- 
isfy the following two conditions: Tr((Ti) — d 6oi, and 
Tr((TiCTj) = d 6ij. In the case of qubit systems, the Pauli 
matrices {(Jo,ax,(7y,az} can be selected, where the ma- 
trix ctq denotes the identity operator 1. For systems on 
7^3, we can use the Gell-Mann operators, that we shall 
denote as {cr^ jf^g. With this representation, a general 
state Pab G ^ 'Hf can be written as 



Pab = 7 



E 

k—{0^x,y,z} 
1=0,. ..,8 



kl, 



(7) 



where the operators Ski — ® erf , the coefficients Xki 
are given by Xki = Tr{SkiPAB), and xqq = Tr{pAB) = 1 
because of normalisation. Eq. ^ allows us to describe 
any bipartite density operator in terms of a fixed number 
of real parameters Xki ■ 

The knowledge of Alice and Bob's POVMs {A,} and 
{Bj}, respectively, together with the observed probabil- 
ity distribution pij, determines the equivalence class of 
compatible states S. Each POVM element Ai and Bj 
can also be expanded in the appropriate operator basis 

as A, = T,k={Q.x,v,z}'^ikcrt and Bj = E/=o,...,8 ^j'^^f ' 
for some coefficients aik and bji, respectively. According 
to Eq. to guarantee that pab G S [first constraint 
in Eq. ^ and in Eq. , we obtain that the coefficients 
Xki must satisfy the following conditions. 



a-ikhjiXki = Pij Vi, j. 

kl 



(8) 



That is, some coefficients Xki are fixed by the known pa- 
rameters Oik, bji, and pij. Any operator pab G S can 
then always be written in the following way. 



Pab{x.) = Pfix + ^ XkiSki, 

klt^I 



(9) 



where pgx corresponds to the part of pab (x) that is com- 
pletely determined b y th e parameters aik, bji, and pij. It 
can be expressed as [36| | 



X — ^ XklSkl, 



(10) 



kiei 



where / denotes a multi-index set labeling those combi- 
nations of the indexes k = {0,x,y,z} and I = 10, 8| 
such that Xki is fixed by Eq. ([5]). (See also Ref. [33].) 

With this representation for pjB (x) , the SDP given by 
Eq. ^ can now be written as [35| 



mmimise 







subject to pab(x) Pab{^) > 0> 



where the symbol © denotes direct sum. Let us com- 
pare the second part of Eq. ^ with the second part of 
Eq. pT|) . The objective variables Xi are now given by 
the coefficients Xki of pAs(x), with kl ^ /, the matrix 
Fq is given by p^x © Pgx, and the matrices Fi are those 
operators Ski © S^i with kl ^ I. 

In the SDP given by Eq. ^ we need to parametrise as 
well the quantum state pab A' ■ The second constraint in 
Eq. ([6]) imposes that pab A' must remain invariant under 
permutation of systems A and A'. This can be done with 
the following parametrisation [2^, [2^ : 



PABA' = ^ E (^fe '^'^ ® ^™ 



(12) 



at ® af ®o^)^Y^ fkik <jt ® <^F ® (^f, 



kl 



with k,m — {0, x, y, z} and ^ = 0, . . . , 8. 

To guarantee that Tt:a'{pabA') = Pab [third con- 
straint in Eq. ([6])] , the state coefficients of pab and paba' 
need to fulfill the following conditions. 



fkiQ ^ Xki yk,i. 



(13) 



That is, some of the state parameters of paba' are al- 
ready fixed by the coefficients of pab- 

To simplify the notation used later on, we shall collect 
the objective variables of the SDP given by Eq. © within 
two different groups of them: The vector x contains those 
coefficients Xki of pab not fixed by Eq. ([5]), and the vec- 
tor y contains those coefficients fkim of paba' not fixed 
by Eq. With this parametrisation, the first three 

constraints in Eq. ^ are fulfilled automatically and the 
SDP given by Eq. ([6]) can be reduced to solve the follow- 
ing one 



minimise 
subject to PABA'{^,y) > 0. 



(14) 



III. 



WITNESS OPERATORS FOR TWO-WAY 
AND ONE-WAY QKD 



In this section we show how to rephrase the QKD veri- 
fication criteria introduced in the previous section into a 
search for appropriate witness operators. In order to do 
this, we use the dual problems associated with the pri- 
mal SDPs given by Eq. (fTTj) and Eq. p^ . respectively. 
In particular, we prove that the solutions to these dual 
problems correspond to the evaluation of an optimal wit- 
ness operator, that belongs to the minimal verification 
set of them for the given two-way or one-way QKD pro- 
tocol, on the observed data pij . A positive expectation 
value of this optimal witness operator states that no se- 
cret key can be distilled from the observed data pij . This 
approach has already been considered for the symmetric 



(11) extension case in Ref. 27 1, and also for a slightly dif 



ferent scenario in Ref. 



38[. Our main motivation here 
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is to show specifically that this relationship still holds 
even if we restrict ourselves to partial information about 
the quantum state. A detailed discussion on some dual- 
ity properties that guarantee that the solution to these 
dual problems can actually be associated with a witness 
operator is included in Appendix Kl 

Let us first introduce the dual problem associated to 
the primal SDP given by Eq. It has the following 
form [Hill]: 

maximise -Tr(FoZ) (15) 
subject to Z > 

Tt{F,Z) = Q \fi, 

where the Hermitian matrix Z is now the objective vari- 
able. This matrix is positive semidefinite Z > and 
is subjected to several linear constraints of the form 
Tt{ZF,) = c, \fi. 



where we have used the property Tr(Z2p^^) = Tr(Z2 pfix) 
and, in the last equality, we defined the operator W = 
Z1+Z2 . Next we show that is a DEWs. For that, note 
that the semidefinite constraint Z > implies Zi, Z2 > 0. 
Moreover, the witness is normalised, since Tr(Z) = 1 
implies Tr(Vl^) = Tr(Zi + Z^) = 1. 

To conclude, we use the remaining equality constraints, 
Tr[(S'fei ® Sli)Z] = Vfc; ^ /, to show that to evaluate 
the expectation value of W one only needs to consider 
Pfix- That is, W belongs to the minimal verification set 
of EWs for the given QKD protocol, and its expectation 
value can be obtained from the observed data pij only [1] . 
Using the ansatz Zi = J^ki ^li^ki, and Z^ = J2ki ^li^ki, 
the equality constraints impose + 2^1 — \/kl ^ I. 
Hence, the DEW W has the following structure 

feiG/ klel 



A. Two-way QKD 

In this section we show that the solution to the dual 
problem associated with the SDP given by Eq. (fTT|) cor- 
responds to the evaluation of an optimal decomposable 
EWs (DEWs) [13, [111 on the observed data pij. (See 
also Ref. [4^.) An EW W is called decomposable if and 
only if there exist two positive operators P,Q>0, and a 
real parameter e G [0, 1], such that W — eP + {1 — e)Q^ 
[13, [3^. In aU EWs are DEWs. In what fol- 

lows, we establish this connection explicitly via the dual 
problem. 

The SDP given by Eq. (jlip can be transformed into 
a slightly different, but completely equivalent, form as 
follows (see Appendix |^ , 

minimise t (16) 
subject to pab(x) ® ^^^(x) + tl > 0, 

where t denotes an auxiliary objective variable. Accord- 
ing to Eq. (fT5|) , the dual problem associated with Eq. (fT6|) 
can be written as 

maximise — Tr[(pfix ® p\-x)Z] 
subject to Z > 

Tr(Z) = 1 

Ti[{Ski®Sli)Z]^Qykl^I. (17) 

The structure of all the matrices which appear in this 
dual problem is the direct sum of two different matrices. 
Then, without loss of generality, we can assume that the 
same block structure is satisfied for Z , i.e., Z — Zi® Z2- 
This means, in particular, that the objective function in 
Eq. p7|) can now be re-expressed as 

Tr[(pfix®pL)(^i®^2)] = Tr[{Zi + Zl)pf,^] 

= Tr(M^pfix), (18) 



with Wki — + zli. Combining Eq. ^ and Eq. (fTOjl . 
we obtain Ty[Wpab{^)\ = Tr(iypfix) = J2ki£i '^kiXki- 

Whenever the solution to the dual problem given by 
Eq. (mi) delivers Tr[(pfix © p^jZ] = Tr(W^pfix) > then 
no secret key can be distilled from the observed data pij 
with two-way classical communication. To see this, note 
that, by definition, Eq. (fT7|) guarantees that there exists 
no other DEW W , that belongs to a verification set of 
them for the given QKD protocol, such that Tr{W'pfi^) < 
Tr(I1/pfix). 



B. One-way QKD 

In this part we use the dual problem associated with 
the SDP given by Eq. to show that its solution corre- 
sponds to the evaluation of an optimal witness operator 
for the case of states with symmetric extensions. We 
shall follow the method introduced in Ref. f27'| , but now 
we will consider specifically the case of partial knowledge 
about the quantum state. (See also Ref. [ioj.) 

Like in the previous section, the feasibility problem 
given by Eq. (fT4|) can be transformed as follows (see Ap- 
pendix El , 

minimise t (20) 
subject to pABA'{x,y) + tl/dA>Q, 

with dA = dim(7i'^), e.g., in our case dA = 2. The 
inclusion of the factor dA in Eq. ([20]) does not alter its 
result and, as we will see at the end of this section, it 
gives the correct normalisation for the witnesses. 

For convenience, we will express the state paba' (x, y) 
in terms of a map A : H^^ «) Hf^ -> Tif^ «> H^^ <^ 
7i^^ that takes an arbitrary Hermitian operator A = 
ll{dAdB)T.ki <^kiSH e ®n^^, with dB = dim(H^), 
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to the Hermitian operator 



HA) 



a 



i={o,...,4-i} 

k={i,...4\-i} 



E 

={o,...,d| 



-1} 



(21) 



Let pfix be again the part of pab G 5 that is fixed 
by the parameters a^fc, bji, and py. Without loss of 
generahty, we consider the foUowing structure for pn^^: 
Pflx = ^/idAdB)Yl,kiei ^kiSki, where the multi-index / 
has the same meaning as before, i.e., it labels those 
combinations of the indexes k — {0,...,d\ — 1} and 
I = {0, — 1} such that Xki is fixed by Eq. 

Using Eq. (PT|) . we can rewrite pABA'{^,y) in the fol- 
lowing compact way, 



PABA'{x,y) A(pfix) + ^ Xki A{Ski) 

kli^I 

+ Y.yj^J^ (22) 



where the Hermitian matrices Gj can be grouped into 
two different sets. 



Gklk = ® erf ® erf V;, Vfc > 1 



G 



(23) 



mlk 



_-B ^ A' 



v;,vfc > m > 1, 



and where the multi-index J is used to label both differ- 
ent combinations of the indices k,l, and to. 

The dual problem associated with Eq. ([^0)1 can now be 
written as 

maximise -Tr[ZA(/9fix)] (24) 
subject to Z >0 

Tt{Z) = dA 

Tr[ZA(^fe,)] = ykl^I 
Tt{ZGj) = VJ. 

Next we search for the most general form of a possible 
solution Z for this dual problem. It will enable us to 
extract the most compact form of a witness operator for 
the symmetric extendibility problem. 

All the linear constraints on the operator Z contained 
in Eq. (|24|) . as well as the objective function itself, are 
invariant under the swap operator P, which exchanges 
the first and the third subsystem. Moreover, the positive 
semidefinite constraint Z = PZP > is also satisfied 
since P is a unitary operator, i.e., P^ — U. This means 
that, if Z is a solution for the dual problem, the opera- 
tor Z is also a possible solution for it, since it fulfills all 
the constraints and it gives exactly the same expectation 



value. Following a similar argumentation, also the equal 
mixture of Z and Z, i.e., Z = 1/2(Z -I- Z), is as well a 
possible solution. Therefore, without loss of generality, 
we can consider that Z is invariant under the swap oper- 
ator P. Under this assumption, it turns out that Z can 
be decomposed as follows 



Z = 



1 



did 



A^B 



E 

- / 

k~>m 



Zmlk [oti ® ' 



(25) 



kl 



Let us now analyse in more detail the linear constraints 
on Z given in Eq. (PO)) . Each linear constraint cancels 
one of the coefficients Zmik- For instance, the constraint 
Tr(ZGiji) imposes Ziji — 0. Then, we can remove all 
these linear constraints, except the normalisation condi- 
tion Tr(Z) = dA, by just making the proper coefficients 
Zmlk in Eq. (I25p equal to zero. This way we arrive at the 
following form for the variable Z, which we shall denote 
by Z*, 



Z* 



1 



d\dB 



A' 



(26) 



/;fc>l 



1^ (g) erf ®(Tk') + Y zm 1^ ® erf (g) 1^' 
I 

oiei 

That is, if we assume the form Z* for the variable Z 
in the dual problem given by Eq. (|24p . then the linear 
constraints are fulfilled automatically. Substituting the 
variable Z with Z* in Eq. (IM)) we obtain the following 
shorter form for the dual problem. 



maximise — Tr[Z*A(pfix)] 
subject to Z* > 

Tr(Z*) = dA. 



(27) 



Now, in order to extract a witness operator from the 
Hermitian operator Z*, we follow the method proposed 
in Ref. HJ 



IjA 



In particular, every map A : Ti^^ 



n 



A' 



has associated an adjoint map A^ 
defined as Tt[U A{V)] = 



Tr[A'f(C/) V] for any Hermitian operators V S '^^^(gHf^ 



and U e nl 



'H^, . With this definition, we can 



rewrite the objective function in Eq. ((27[) as 

Tr[Z*A(pfi,)] = Tr[At(Z*)pfi,] = Tr(iy,y,nPfix), (28) 

where we defined Wgym = At(Z*) as the desired wit- 
ness operator for the symmetric extendibility problem. 
In the remaining part of this section, we obtain the gen- 
eral structure of the witness operator Wgym- For that, we 
simply apply the adjoint map A^ to the operator Z*, set 
the resulting operator equal to an operator of arbitrary 
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form W*, solve the equality constraint, and, finally, for- 
mulate the dual problem in terms of this new operator 
W*. 

The map A^^ can be written as [13], 

^^(^) = ^[^^A'{z)+i:YA'{PZP)-^t^(i(>i:TAA'{z)\. 

a A a A 

(29) 

Setting A^(Z*) equal to an arbitrary Hermitian opera- 
tor W* = l/{dAdB)J2ki''^kiSki we obtain the following 
equality constraint 



01- 



(30) 



kl 



l;k>l 
kl£l 



I 

olei 



Since we have expressed every operator in terms of an 
operator basis, the equality constraint can only be ful- 
filled if the coefficients Zkim of Z* , and the coefficients 
Wki of W* , are related via: 



Wki = 2zkio/dA yi,yk > l,kl <E I, 
Wki =0 kl ^ I. 



(31) 



Now, instead of considering the matrix Z* as the objec- 
tive variable of the dual problem, we can equivalently 
consider the matrix W* as the free variable. In order to 
do so, we only need to translate the positive semidefi- 
nite constraint Z* > together with the normalisation 
condition Tr(Z*) = dA included in Eq. (|27p into new 
constraints on W* . This can be done by using Eq. ((3T|) . 
This way, we arrive at the following form for the dual 
problem: 



maximise —Tt{W* pax) 



(32) 



subject to W* (g) 1-^' + P{W* (g) a^' )P > 



1, 



where the variable W* represents a witness operator for 
the symmetric extendibility problem. Moreover, from 
Eq. ((3T|) we obtain that W* can always be expressed as 



W* 



1 



dAdi 



WkiSk 

klGl 



(33) 



That is, W* belongs to the minimal verification set of wit- 
nesses for the given one-way (RR) QKD protocol. Like 
in the previous section, whenever the solution to the dual 
problem given by Eq. ([5^ delivers Ti{W*pfix) > then 
no secret key can be distilled from the observed data pij 
with one-way RR. The case of one-way QKD with DR 
can be analysed in a similar way. 



IV. EVALUATION 

In this section we study the two-state QKD protocol 
[20| . both for the case of two-way and one-way classi- 
cal communication. The analysis for other qubit-based 



QKD schemes is completely analogous, and we include 
very briefly the results of our investigations on other well- 
known QKD protocols in Appendix |B] We refer here to 
single-photon implementations of the qubit. The state 
of the qubit is described, for instance, by some degree 
of freedom in the polarisation of the photon. In our cal- 
culations we follow the approach introduced in Sec. [TTl 
although similar results could also be obtained using the 
witness approach presented in Sec. IIIII The numeri- 
cal evaluations are performed with the freely-available 
SDP solver SDPT3-3.02 [iTJ, together with the input tool 
YALMIP 'ii]. 

We shall consider that the observed joint probability 
distribution pij originates from Alice and Bob measuring 
the following quantum state 



Pab 



(1-p) 



^PA' 



+ PPA ® \vac) g{vac\, 



(34) 



where p € [0, 1] denotes the probability that Bob receives 
the vacuum state \vac) g, e G [0, 1] represents an error pa- 
rameter (or depolarising rate) of the channel, 1"^ is the 
identity operator on Alice's Hilbert space, U^{9) repre- 
sents a unitary operator acting on Bob's system, \iI^)ab 
denotes the effective bipartite state initially prepared by 
Alice in the given QKD protocol, pA represents Alice's 
reduced density matrix (i.e., pA = TrB{\i^) ab{'^\))^ ^^'^ 
the operator 1^ is given by 1^ — 1^ — \vac) g{vac\. 

The quantum state given by Eq. (|34p defines one pos- 
sible eavesdropping interaction. But our analysis can 
straightforwardly be applied to other quantum channels, 
as it depends only on the probability distribution pij 
that characterises the results of Alice's and Bob's mea- 
surements. We include the operator U^{9) in Eq. p4l) 
to model the collective noise (or correlated noise) in- 
troduced by the quantum channel {e.g., optical fiber) 
[43I |4^ . This noise arises from the fluctuation of the 
birefringence of the optical fiber which alters the polar- 
isation state of the photons. When this fluctuation is 
slow in tinie, its effect can be described with a unitary 
operation [J^, [3] . For simplicity, we shall consider that 
[6) is parametrised only with one real parameter 6. In 
particular, we choose U^{e) = cos6'lO)(Ol - sin6llO)(ll + 
sin6'll)(0l + cos6'll)(ll + \vac){vac\ with 9 e l0,7r/4]. If 
6* = no collective noise is present and Eq. ((34|) describes 
a depolarising channel with loss. 

In order to illustrate our results, we calculate an upper 
bound on the tolerable depolarising rate e as a function of 
the photon loss probability p £ [0, 1]. Moreover, for sim- 
plicity, we take only two different values of the angle 9. 
For instance, we choose 9 — and 9 = tt/8. These three 
parameters, e, p, and 9, allow us to evaluate the perfor- 
mance of a QKD protocol when the quantum channel is 
described by Eq. One could also select other fig- 

ures of merit in order to evaluate a protocol, such as the 
quantum bit error rate (QBER) . This is the rate of events 
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where Alice and Bob obtain different results. It refers to 
the sifted key, i.e, it considers only those events where 
the signal preparation and detection methods employ the 
same polarisation basis. We include as well an analytic 
expression for the QBER for the given QKD protocol. 



A. Two-state protocol 

The two-state protocol ^2d\ is one of the simplest QKD 
protocols. It is based on the random transmission of only 
two nonorthogonal states, \ipo) and Ahce chooses, 

at random and independently every time, a bit value i, 
and prepares a qubit in the state \(pi) = a|0) + (— 
with < a < I/V2 and /3 = Vl — a^, that is sent it 
to Bob. On the receiving side. Bob measures the qubit 
he receives in a basis chosen at random within the set 

{{\^o),\v^)},{\Vi)M)}}, with = 0. The 

loss of a photon corresponds to a projection onto the 
vacuum state \vac). Bob could also employ a different 
detection method defined by a POVM with the follow- 
ing operators: Bj = 1/ {2f3'^)\ipi_j){ipj-_j\ with j = 0,1, 
Bnuii = |0)(0| + |1)(1| - J2^Bj, and B^ac = \vac){vac\. 
In this last case, Alice's bit value i is associated with 
the operator Bi, while the operator BnuU represents an 
inconclusive result. This is the approach that we shall 
consider here. 

The preparation process can be thought of as Al- 
ice prepares first the bipartite signal state \iP)ab = 
1 / V2{\0) a\'^o) b + \^)a\^i)b), and then she measures her 
first subsystem with the POVM operators Ai — 
with i = 0, 1. The fact that the reduced density matrix 
of Alice is fixed and cannot be modified by Eve is vital 
to guarantee the security of this scheme. Otherwise, the 
joint probability distribution pij alone does not allow Al- 
ice and Bob to distinguish between the entangled state 
\'i(j)ab and the separable one aAB = V^X^i^o ^ 
\'fi)B{fi\ We need to add then to the observables 

given above also the operators ax ctq and ay (8) ao such 
as Alice has complete tomographic knowledge of pA- 

Following the approach introduced in Sec. HIl in Fig. [T] 
we present an upper bound on the tolerable depolarising 
rate e as a function of the photon loss probability p for 
two different values of the parameter a. It states that no 
secret key can be distilled from the correlations estab- 
lished by the users. In this example, the results obtained 
coincide when 9 — and 6 — tt/8. To obtain an upper 
bound on the tolerable QBER one can use the following 
expression 



Two state Protocol: a=0.2 



QBER = 



2sin2 6l + (l-2sin2 e)e 
2{2/32-)-(a2-/32)[^ + (l-^)e]}^ 



(35) 



with 7 = 2{a^ sin^ 9 + 0^ cos^ 9). In particular, for given 
values of the parameters a, /3, and 0, one only needs to 
substitute in Eq. ((35)) the value of e given in Fig. [T] as a 
function of the parameter p. 

Remarkably, the cut-off point for two-way QKD pre- 
sented in Fig. [U i.e., the value of the photon loss proba- 
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FIG. 1: Upper bound on the depolarising rate e as a function 
of the photon loss probability p for the two-state QKD proto- 
col. The equivalence class of states S is fixed by the observed 
data Pij , which are generated via measurements onto the state 
given by Eq. (|34|) . Two-way classical post-processing is illus- 
trated with a solid line. One-way classical post-processing is 
represented with a dashed line for RR, and with a dotted line 
for DR. The cases 9 = and 9 = n/S provide the same re- 
sults. It states that no secret key can be obtained from the 
correlations established by the users. 



bility p that makes e = and also QBER = 0, coincides 
with the limit imposed by the unambiguous state dis- 
crimination attack m. Ha 113, ES,, 49] . In the two-state 
protocol this limit is given by p = 1 — 2a^ . (See also 
Ref. [13].) Fig. [T] also shows a difference between one- 
way classical post-processing with RR and with DR as 
a function of the parameter p. The reason behind this 
effect is beyond the scope of this paper and needs further 
investigations. 



V. CONCLUSION 

A fundamental question in quantum key distribution 
(QKD) is to determine whether the legitimate users of 
the system can use their available measurement results 
to generate a secret key via two-way or one-way clas- 
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sical post-processing of the observed data. In this pa- 
per we have investigated single-photon QKD protocols 
in the presence of loss introduced by the quantum chan- 
nel. Our results are based on a simple precondition for 
secure QKD for two-way and one-way classical communi- 
cation. In particular, the legitimate users need to prove 
that there exists no separable state (in the case of two- 
way QKD) , or that there exists no quantum state having 
a symmetric extension (one-way QKD), that is compati- 
ble with the available measurements results. 

We have shown that both criteria can be formulated 
as a convex optimisation problem known as a primal 
semidefinite program (SDP). Such instances of convex 
optimisation problems can be solved efhciently, for exam- 
ple by means of interior-point methods. Moreover, these 
SDP techniques allow us to evaluate these criteria for any 
single-photon QKD protocol in a completely systematic 
way. A similar approach was already used in Ref . [25| for 
the case of one-way QKD without losses. Here we com- 
plete these results, now presenting specifically the analy- 
sis for the case of a lossy channel. Furthermore, we have 
shown that these QKD verification criteria based on SDP 
provide also a means to search for witness operators for a 
given two-way or one-way QKD protocol. Any SDP has 
an associated dual problem that represents also a SDP. 
We have demonstrated that the solution to the this dual 
problem corresponds to the evaluation of an optimal wit- 
ness operator that belongs to the minimal verification set 
of them for the given two-way (or one-way) QKD proto- 
col. Most importantly, a positive expectation value of 
this optimal witness operator guarantees that no secret 
key can be distilled from the available measurements re- 
sults. Finally, we have illustrated our results by analysing 
the performance of several well-known qubit-based QKD 
protocols for a given channel model. 
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APPENDIX A: SOME DUALITY PROPERTIES 

In this Appendix we present some duality properties of 
a general SDP [l^,!!^! that guarantee that the solution to 
the dual problems introduced in Sec. lIIII can be associated 
with a witness operator. 



The primal problem given by Eq. ([2]) is called feasi- 
ble (strictly feasible) if there exists x such as F{x.) > 
(F(x) > 0). Similarly, the dual problem given by Eq. 
is called feasible (strictly feasible) if there exists a matrix 
Z > {Z > 0) which fulfills all the desired constraints. 

The weak duality condition, illustrated in Eq. (|A1|) , al- 
lows to derive simple upper and lower bounds for the 
solution of either the primal or dual problem. In partic- 
ular, for every feasible solution x of the primal problem 
and for every feasible solution Z of the dual problem, the 
following relation holds: 

c'^x + Tr(Zi^o) = Tr(ZF(x)) > 0. (Al) 

The strong duality condition certifies whether the op- 
timal solution to the primal and dual problem, that we 
shall denote as p* and d* , respectively, are equal. More 
precisely, p* = c?* if (1) The primal problem is strictly fea- 
sible, or (2) The dual problem is strictly feasible. More- 
over, if both conditions are satisfied simultaneously then 
it is guaranteed that there is a feasible pair (xopt, Z^pt) 
achieving the optimal values p* = d* . This last condition 
is known as the complementary slackness condition. 

The SDP given by Eq^JEL when c = 0, can always be 
transformed as follows [23, |24| 

minimise t (A2) 
subject to F(x, t) = F(x) + > 0. 

This SDP is always strictly feasible. To see this, note that 
if x = and t > \ min^ Xi{Fo)\, where Xi{Fo) denote the 
eigenvalues of the matrix Fq, then F(x, t) > 0. Moreover, 
it can be shown that Eq. (|A2[) is equivalent to the original 
SDP. Let t* be the solution to Eq. ^M^. If t* > 0, the 
original problem is infeasible since F{x) ^ V x. On the 
other hand, if i* < there exists x such that F(x) > 0, 
stating that the original problem is feasible. That is, the 
solution t* of the SDP given by Eq. (|A2p certifies whether 
the original problem is indeed feasible or not. 

The dual problem associated with Eq. (|A2[) is given 
by: 

maximise -Tr(FoZ) (A3) 
subject to Z > 

Tt{F,Z) = Vi, 
Tt{Z) = 1. 

If all the matrices Fi are traceless, i.e., Tr{Fi) = 0, this 
dual problem is also always strictly feasible. A trivial 
strictly feasible solution to this problem is given hy Z = 
l/d > 0, where d denotes the dimension of F.^. 

If we apply the three duality conditions mentioned 
above to the SDPs given by Eq. dH]) and Eq. 
we find that, if Eq. (|A2p delivers an infeasible solution 
t* > 0, 

Tr(f^o^opt) = -d* = -t* < 0. (A4) 

This arises from the fact that the strong duality relation 
guarantees that d* — t* , and the complementary slack- 
ness condition certifies that there is a Zopt that achieves 
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the optimal value d*. 
condition assures that 



When t* < the weak duality 



Six state Protocol 



0.7 



Tr(i^o^) >-t*>0 



(A5) 



for every feasible solution Z of the dual problem. Both 
results together show that the solution to the dual prob- 
lem given by Eq. (jA3|) can be associated to a witness 
operator W. In particular, the ability of W to detect, at 
least, one state, i.e., 3 p such as Ti{W p) < 0, can be re- 
lated with Eq. (IA4p . On the other hand, the requirement 
that W is positive on all states belonging to a given set 
of them can be related with Eq. (jA5|) . To achieve the 
desired equivalence, however, the dual problem must be 
strictly feasible, otherwise the complementary slackness 
condition does not hold and the existence of an appro- 
priate witness is not guaranteed. It turns out that all 
the linear constraints included in the dual problems con- 
sidered in Sec. IIIII have traceless matrices Fi, such that 
these dual problems are always strictly feasible. 



APPENDIX B: MORE QUBIT-BASED QKD 
SCHEMES 

In this Appendix we include very briefly the results of 
our investigations on other well-known qubit-based QKD 
protocols. Like in Sec. IIV( we shall consider that the 
observed data pij are generated via measurements onto 
the state given by Eq. (p4)) . 



1. Six-state protocol 

In this scheme, Alice prepares a qubit in one of the 
following six quantum states: {|0), |1), |±) = l/\/2(|0) ± 
|1)),|±) = 1/V2(|0) ± and sends it to Bob 

On the receiving side, Bob measures each incoming sig- 
nal by projecting it onto one of the three possible bases. 
The loss of a photon in the channel is characterised by a 
projection onto the vacuum state \vac). 

The resulting upper bound on the tolerable depolar- 
ising rate e is illustrated in Fig. [51 The QBER is given 
by 



QBER = I 
6 



4 sin^ 61 + (3 - 4 sin^ 



(Bl) 



For 6 ^ we find, as expected, that whenever QBER > 
33% (corresponding to a value of e = 0.66) no secret 
key can be distilled by two-way classical post-processing 
[lalli. In the case of one-way classical post-processing 
(both for RR and DR), and assuming 9 = and p = 0, 
we obtain that secure QKD might only be possible for 
a QBER < 1/6 (e = 0.33). A possible eavesdropping 
strategy to attain this cut-off point is, for instance, to 
use an universal cloning machine to clone every signal 
sent by Alice such as the fidelities of Eve's and Bob's 
clones coincide [s^. (See also Ref. j25|.) 
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FIG. 2: Upper bound on the depolarising rate e as a function 
of the photon loss probability p for the six-state QKD pro- 
tocol. Two-way classical post-processing is illustrated with 
a solid line, while one-way classical post-processing is repre- 
sented with a dashed line for RR, and with a dotted line for 
DR. The cases 9 — and — tv/S provide the same results in 
this case. 



2. Four-state protocol 

The four-state protocol [l^ is similar to the six-state 
protocol, but now Alice sends one of four possible signal 
states instead of one of six. In particular, she chooses 
one state within the set {|0), |1), |±)} and sends it Bob. 
Each received signal is projected by Bob onto one of the 
two possible bases, together with a projection onto the 
vacuum state \vac) corresponding to the loss of a photon. 

The resulting upper bound on the depolarising rate e 
is illustrated in Fig. [3l The QBER is now given by 



QBER 



(1 - 2sin2 



(B2) 



If 6* = we obtain the well-known result stating that 
whenever QBER > 25% (corresponding to a value of e = 
0.5) no secret key can be distilled by two-way classical 
post-processing 1585. Similarly, for the case of one-way 
classical post-processing, and assuming 6 = and p = 
0, we find that the QBER must be lower than 14, 6% 
(e = 0.292). This last result coincides with the value of 
the QBER produced by an eavesdropping strategy where 
Eve and Bob Shannon information are equal (60l . [6l| . 



3. Qubit-based four-plus- two-state protocol 

This scheme can be seen as a combination of two 
two-state QKD protocols [111, [13] ■ More precisely, Al- 
ice selects, at random and independently each time, 
one of the following four signal states, {\(pk) = Q;|0) -I- 
(-1)'=/3|1), \ipk) = a\0) + i(-l)V|l)} with fc = 0, 1, and 
sends it to Bob. On the receiving side. Bob measures 
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Four State Protocol 



Four Plus Two State Protocol: a=0.2 
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FIG. 3: Upper bound on the depolarising rate e as a function 
of the photon loss probability p for the four-state QKD pro- 
tocol. Two-way classical post-processing is illustrated with 
a solid line, while one-way classical post-processing is repre- 
sented with a dashed line for RR, and with a dotted line for 
DR. The cases ^ = and 9 — tv/S provide the same results in 
this case. This upper bound also coincides for the case of the 
trine protocol and for the QKD scheme proposed in Ref. [57| 
when 9 = 0. 



each incoming signal by choosing, at random and inde- 
pendently for each signal, one of two possible POVMs. 
Each POVM corresponds to the one used in the two-state 
protocol (see Sec. II V A]) for the signal states \(fk} = Q;|0)-|- 
(-1)'=^/3|1), with fc = 0, 1, and \ipf,) = q|0) + i(-l)'=/3|l), 
with fc = 0, 1, respectively. 

The resulting upper bound on the depolarising rate e 
is illustrated in Fig. [4] for the cases a — 0.2 and a = 0.4. 
The QBER is given by 



QBER^ 



:+(l-e)[l-f (a2-/32)2 



sm 



2[e 4- (1 - e)[2(a4 + (3^) sin^ 9 + Aa^P^ cos^ 9]] 

(B3) 

In the case of two-way classical post-processing, the max- 
imum tolerable value of e shown in Fig. 3] starts decreas- 
ing as the losses in the channel increase, and, at some 
point, it becomes constant independently of p. Interest- 
ingly, the value of p where this inflexion occurs, corre- 
sponds to the point where Eve can discriminate unam- 
biguously between the two states in the set {If/^fc)}, with 
fc = 0, 1, or between those states in the set {[Vfc)}, with 
k = 0, 1. This happens when p = 1 — 2c? . 



4. Three-state protocol 
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Four Plus Two State Protocol: a=0.4 
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FIG. 4: Upper bound on the depolarising rate e as a function 
of the photon loss probability p for the qubit-based four-plus- 
two-state QKD protocol. Two-way classical post-processing 
is illustrated with a solid line, while one-way classical post- 
processing is represented with a dashed line for RR, and with 
a dotted line for DR. The cases = and = 7r/8 provide 
the same results. 



The resulting upper bound on the depolarising rate e 
is illustrated in Fig. [5] The QBER has now the following 
form 



QBER = i 



1 + (1 - e)(sin2e'- cos^ 



(B4) 



For the quantum channel given by Eq. (|34p . and assum- 
ing = or = tt/S, the maximum value of e toler- 
ated by the three-state protocol coincides with the four- 
state protocol for the cases of two-way and one-way post- 
processing with DR. 



This QKD scheme requires Alice sending to Bob one 
of the following three quantum states |0),|1), and |-f) 
[H, m, m, mi ■ on the receiving side, Bob projects each 
incoming signal onto one of the two possible bases used 
in the four-state protocol (see Sec. IB 2[) . together with a 
projection onto the vacuum state \vac). 



5. Trine protocol 

In the trine protocol [Kll, Alice selects, at random and 
independently each time, a qubit in one of the following 
three states: |0), 1/2|0) \/3/2|l), and 1/2|0) - V3/2|l), 
and sends it to Bob. Each received signal is measured 
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Three State Protocol 
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(1 — i)/2|l) [53, [63|. On the receiving side, Bob mea- 
sures each incoming signal with one of two possible mea- 
surements corresponding to the bases l/\/2(|0) ie"'*^!!)) 
with (f) = {7r/4, — 7r/4}, that he selects at random and in- 
dependently for each signal, together with a projection 
onto the vacuum state \vac). 

When 9 = 0, the maximum value of e tolerated by this 
protocol, both for two-way and one-way post-processing, 
coincides with the four-state protocol (see Fig. [S]) . The 
case = 7r/8 is illustrated in Fig. [S] 

The QBER is now given by 



QBER = i 



(1 - e)sin^6l-|-e 



(B6) 



FIG. 5: Upper bound on the depolarising rate e as a function 
of the photon loss probability p for the three-state QKD pro- 
tocol. Two-way classical post-processing is illustrated with 
a solid line, while one-way classical post-processing is repre- 
sented with a dashed line for RR, and with a dotted line for 
DR. The cases 6 = and 6 = n/8 provide the same results. 



by Bob with a POVM defined by the following opera- 
tors: Bo = 2/3|l)(l|, B, = 2/3\i>,){ij,\, with i = 1,2, 
and where IV-^) = \/3/2|0> + (-1)*1/2|1), and B^ac = 
\vac){vac\. 

For the quantum channel given by Eq. p4p . and as- 
suming 9 = or 9 = 7r/8, it turns out that the maximum 
value of e tolerated by this scheme, both for two-way 
and one-way post-processing, coincides with the four- 
state protocol (see Fig. [3]). The QBER, however, is given 

by 



QBER 



2e + 4(1 - e) sin^ 9 
3 + e + 2{l-e) sin^6l' 



(B5) 



6. Acm-Massar-Pironio protocol 
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Acin Massar Pironio Protocol: 6=pl/8 
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FIG. 6: Upper bound on the depolarising rate e as a func- 
tion of the photon loss probability p for the QKD protocol in 
Ref. [stI when 9 = -k/8. Two-way classical post-processing 
is illustrated with a solid line, while one-way classical post- 
processing is represented with a dashed line for RR, and with 
a dotted line for DR. 



In this scheme, Alice sends to Bob one of the follow- 
ing six states: |+), |-), l/\/2(|0) ± and l/\/2|0) ± 
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